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Waypoint Navigation 

5 THE BACKGROUND OF THE INVENTION AND PRIOR ART 

The present invention relates generally to remote control of 
unmanned aerial vehicles. More particularly the invention relates 
to a method according to the preamble of claim 1, a computer 
program according to claim 13, a computer readable medium 
10 according to claim 14 and an unmanned aerial vehicle according 
to the preamble of claim 15. 

Remotely controlled unmanned aerial vehicles (UAV:s) repre- 
sent an increasingly important field of aircraft technology, 
particularly for the military sector. UAV:s may namely be used to 
15 perform a large variety of military operations, such as recon- 
naissance flight and target combating. Therefore, the prior art 
includes various examples of solutions for controlling a UAV. 

For instance, the U.S. patent No. 6,377,875 describes a method 
for controlling a UAV wherein upon loss of radio contact bet- 

20 ween a control station and the UAV, the UAV flies according to a 
pre-programmed safety route. During any interruption of the 
radio contact, the UAV will fly on a substitute route, which is 
calculated in the UAV. Various methods of returning the UAV 
after a completed mission, or at the event of loss of radio 

25 contact, are also described. 

However, the problem of preventing a UAV from crashing uncon- 
trollably during a time period when the radio contact is broken 
remains to be solved. Namely, basically at any time, a critical 



fault condition may arise in tlie UAV, which renders all return 
routes from the vehicle's present location impossible, and 
instead forces the UAV to perform a relatively speedy landing 
operation. Naturally, if such a landing takes place without 
5 particular measures being taken, there is a substantial risk that 
serious adverse effects occur on the ground, for example in the 
form of injuries to personnel or material damages. In fact, no 
solution is yet known which is capable of handling a critical fault 
condition in a UAV concerning its flight control parameters 
10 without a command link between the UAV and a control station 
being active. 

SUMMARY OF THE INVENTION 

It is therefore an object of the present invention to alleviate the 
problem above and thus provide an improved solution for con- 
15 trolling an unmanned aerial vehicle. 

According to one aspect of the invention this object is achieved 
by the method of controlling an unmanned aerial vehicle as 
described initially, which is characterized by the set of flight 
control parameters including at least one engine parameter. The 

20 method includes the following steps. A major alarm condition 
with respect to an engine failure is activated in case at least one 
of the at least one engine parameter decreases below a 
threshold value, for instance if the engine stalls. In such case, 
the emergency route involves flying the vehicle to an air space 

25 above a termination waypoint on the ground where it is 
estimated that the vehicle's flight may be ended without injuring 
any personnel or causing uncontrolled material damages. Thus, 
the emergency route is planned such that at any geographical 
position and altitude thereon a suitable termination waypoint 

30 may be reached in the event of an engine failure. 

Naturally, an important advantage attained by this strategy is 
that the risk of serious adverse effects on the ground occurring 
due to a crashing UAV is thereby reduced significantly. 
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According to a preferred embodiment of this aspect of the 
invention, the set of flight control parameters also includes a 
command link parameter. The method also Involves activating a 
minor alarm condition with respect to a command link failure in 
5 case the command link is interrupted during a first, and rela- 
tively short, time interval. In such case, a horizontal flight of the 
vehicle is initiated. Typically, this is an appropriate step to take 
in order to avoid a crash, for example if the vehicle has entered 
a steep dive when the command link failure occurs. 

10 According to another preferred embodiment of this aspect of the 
invention, the method includes the step of activating a major 
alarm condition with respect to a command link failure in case 
the command link is interrupted during a second time interval, 
which exceeds the first time interval. In such case, the emer- 

15 gency route involves flying the vehicle towards a base location 
on the ground. Thereby, the chances of reestablishing the radio 
contact with the base station are improved, and the link failure 
might be resolved. 

According to another preferred embodiment of this aspect of the 
20 invention, the flying of the vehicle towards the base location 
involves elevating the vehicle to a predetermined altitude. 
Namely, this further improves the chances of reestablishing the 
command link, since generally, the radio conditions are more 
favorable at a higher altitude. 

25 According to another preferred embodiment of this aspect of the 
invention, the alarm condition with respect to the minor com- 
mand link failure is cleared in case the command link returns 
before expiry of the second time interval. Thereafter, the flight 
control of the vehicle is returned to the mode of operation in 

30 which it was controlled before the interruption in the command 
link, i.e. autonomous or manual respectively. This allows the 
control station to order the vehicle to resume its mission, which 
of course, is desirable. Preferably, however, an operator ack- 
nowledgement is required before the control of the vehicle is 
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returned to the original mode. 

According to anotlier preferred embodiment of this aspect of the 
invention, the emergency route involves flying the vehicle to an 
air space above a termination waypoint on the ground, in case 
5 the command link remains interrupted during a third time inter- 
val, which exceeds the second time interval. The length of third 
time interval is selected with respect to the accuracy in the 
navigation of the vehicle, such that during the third time interval 
the vehicle may not divert unacceptably far from the intended 
10 route. Consequently, high navigation accuracy allows the third 
time interval to be relatively long, and vice versa. 

According to another preferred embodiment of this aspect of the 
invention, in case of a major alarm condition has been activated 
with respect to a command link failure, and the command link 

15 remains interrupted during a fourth time interval, which exceeds 
the third time interval, an emergency landing of the vehicle is 
initiated at the termination waypoint. Provided that the fourth 
time interval is selected to a suitable value, a safe emergency 
landing at a predetermined location may thereby be accom- 

20 plished. 

According to another preferred embodiment of this aspect of the 
invention however, in case the command link returns at any 
instance in time, the method involves transmitting a link status 
message from the vehicle to the control station, which indicates 

25 a functioning condition for the command link. Preferably, after 
transmission of the link status message, the method involves the 
following steps. First, the vehicle is enabled to receive over- 
riding commands from the control station via the command link. 
Then, in case such overriding commands are received, the flight 

30 according to the emergency route is discontinued, and a flight 
control according to the autonomous or the manual mode is 
enabled. Thereby, the vehicle may also be controlled to resume 
its mission if this should be desired. 
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According to one preferred alternative embodiment of this 
aspect of the invention, the autonomous flight control mode invol- 
ves transmission of the control commands to the vehicle in the 
form of a number of commands constituting an alternative set of 
5 waypoints. I.e. a set of geographical coordinates and altitudes is 
sent from the control station to the vehicle when the vehicle is 
already in the air. Typically, the data set specifies positions which 
the vehicle shall pass In a relatively near future. Generally, this 
procedure is advantageous to apply if the vehicle is located 
10 within, or in proximity of a mission area. Thus, it may conveniently 
be controlled to complete a particular mission. 

According to another preferred alternative embodiment of this 
aspect of the invention, the manual flight control mode involves 
transmission of the control commands to the vehicle in the form of 
15 real-time commands. I.e. an operator on the ground or in another 
vehicle may control the UAV in response to joystick commands. 
Generally, this procedure is advantageous to apply if the UAV is 
located in proximity of a base location, such as a landing strip / 
runway, where it may be landed manually. 

20 According to yet another preferred embodiment of this aspect of 
the invention, points from the first set of predefined waypoints 
are selected from an indexed table by means of a stepwise 
procedure. However, points from the second set of predefined 
waypoints are selected by means of jumping from a first line in 

25 the indexed table to a second line In the indexed table. The 
second line is specified on the first line. Such a stepwise 
procedure is highly advantageous because it enables a very 
uncomplicated and straightforward implementation. 

According to a further aspect of the invention the object is 
30 achieved by a computer program directly loadable into the inter- 
nal memory of a computer, comprising software for performing 
the above proposed method when said program is run on a 
computer. 
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According to another aspect of the invention the object is 
achieved by a computer readable medium, having a program 
recorded thereon, where the program is to make a computer 
perform the above-proposed method. 

According to another aspect of the invention, this object is 
achieved by the unmanned aerial vehicle as described initially, 
which is characterized in that the set of flight control parameters 
includes at least one engine parameter. The functional moni- 
toring system is adapted to, in case at least one of the at least 
one engine parameter decreases below a threshold value, set 
an alarm condition with respect to an engine failure. Moreover, 
the functional monitoring system is adapted to, in such case, fly 
(or at least glide fly) the vehicle according to an emergency 
route to an air space above a termination waypoint on the 
ground where it is estimated that the vehicle's flight may be 
ended without injuring any personnel or causing uncontrolled 
material damages. Consequently, the risk that serious adverse 
effects are caused on the ground due to a crashing UAV is 
thereby reduced significantly. 

20 According to a preferred embodiment of this aspect of the 
invention, the functional monitoring system is also adapted to 
monitor the wireless command link. In case the command link is 
interrupted during a first (and relatively short) time interval, the 
functional monitoring system is adapted to activate a minor 

25 alarm condition with respect to a command link failure, and 
initiate a horizontal flight of the vehicle. Thereby, for instance, a 
crash due to the vehicle performing a manually controlled steep 
dive may be avoided. 

According to a preferred embodiment of this aspect of the 
30 invention, the functional monitoring system is also adapted to, in 
case the command link is interrupted during a second time 
interval which exceeds the first time interval, perform the steps 
of activating a major alarm condition with respect to a command 
link failure, and flying the vehicle towards a base location on the 
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ground. Thereby, the risk that the vehicle is forced to perform an 
uncontrolled landing is further reduced. 

According to a preferred embodiment of this aspect of the 
invention, the functional monitoring system is adapted to, in case 
5 the command link returns before expiry of the second time 
interval effect the following; clear the alarm condition with 
respect to the minor command link failure, and return the flight 
control of the vehicle to the control sub-system which controlled 
the vehicle before the interruption in the command link, i.e. 
10 either the autonomous or the manual control sub-system. 
Hence, the vehicle's mission may be resumed. 

According to a preferred embodiment of this aspect of the 
invention, the functional monitoring system is adapted to, in case 
the command link remains interrupted during a third time interval 
15 which exceeds the second time interval, fly the vehicle to an air 
space above a termination waypoint on the ground where it is 
estimated that the vehicle's flight may be ended without injuring 
any personnel or causing uncontrolled material damages. 

According to a preferred embodiment of this aspect of the 
20 invention, the functional monitoring system is adapted to initiate a 
landing of the vehicle at the termination waypoint if the 
command link failure remains at expiry of a fourth time interval 
after that the command link failure occurred. The fourth time 
interval at least exceeds the third time interval. Thus, provided 
25 that the fourth time interval is selected to a suitable value, a 
safe landing may be accomplished. 

According to a preferred embodiment of this aspect of the 
invention, the functional monitoring system is adapted to, in case 
the command link returns at any instance in time, generate a 
30 link status message which indicates a functioning condition for 
the command link. 

Preferably, the functional monitoring system is also adapted to, 
after that the link status message has been transmitted to the 
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control station execute the following; enable the vehicle to 
receive overriding commands from the control station via the 
command link, and in case such overriding commands are 
received, discontinue a flight according to the emergency route, 
5 such that the vehicle may be manually controlled via the manual 
control sub-system. 



BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention is now to be explained more closely by 
means of preferred embodiments, which are disclosed as 
10 examples, and with reference to the attached drawings. 

Figure 1 illustrates the proposed method of controlling a 
UAV by means of an exemplary primary- and emer- 
gency route respectively, 

Figure 2 shows a time line, which illustrates the extension of 
15 and relationships between time intervals applicable 

according to embodiments of the invention, 

Figure 3 shows a block diagram over a signal processing 
system according to an embodiment of the inven- 
tion, 

20 Figure 4 shows a first flow diagram, which summarizes the 

general method according to the invention, and 

Figure 5 shows a second flow diagram, which illustrates the 
method according to preferred embodiments of the 
invention. 



25 DESCRIPTION OF PREFERRED EMBODIMENTS OF THE 
INVENTION 

Figure 1 illustrates the proposed method of controlling an un- 
manned aerial vehicle 100 by means of an exemplary primary 
route R1/RV and an exemplary emergency route R2'. A control 
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station 110 controls the vehicle 100 by means of a wireless 
command link 115. Preferably, at least in a military application 
and where the control station 110 is ground based, it should be 
geographically separated from a base station transceiver 120, 
5 which serves the command link 115. Namely thereby, the control 
station's 110 position cannot be determined on basis of the 
traffic over the command link 115. However, if the control station 
110 is mobile, for instance positioned In another aircraft, it is 
generally preferable to co-locate it with the base station trans- 
10 ceiver 120 for practical reasons. 

It is presumed that the vehicle 100 takes off from a runway at a 
base location 130, which preferably is located relatively proxi- 
mate to the control station 110 (provided that this type of control 
station is used). The vehicle 100 may then be controlled to fly 

15 along the primary route R1, for example to a mission area 140, 
where it executes one or more tasks, such as combating a target 
or performing a reconnaissance mission. The flight of the 
vehicle 100 can be controlled in either an autonomous mode or 
a manual mode. In the autonomous mode the vehicle 100 

20 follows a route, which is defined by a set of stored waypoints. 
The stored waypoints may, in turn, either be pre-programmed 
(i.e. defined before take off), or be in-flight programmed (i.e. 
defined after take off and sent to the vehicle 100 via the 
command link 115). Figure 1 shows an example of a pre- 

25 programmed route R1, which starts at the base location 130 and 
includes the consecutive waypoints WP1, WP2, WP3, WP4, 
WP5, WP6, WP7, WPS and a final approach point IP to the base 
location 130. 

In the manual mode however, the vehicle 100 follows a flight 
30 path RV, which is defined in real-time during the flight. This can 
be accomplished by transmitting flight control commands, via 
the wireless command link 115, from the control station 110 to 
the vehicle 100, such that the flight path RV is defined gra- 
dually. For instance, in the manual mode, the real-time control 
35 of the vehicle 100 may be aided by camera images recorded by 
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the vehicle 100 and forwarded to the control station 110 over the 
wireless command link 115. Technically, the manual mode may 
be entered at any time. However, the manual mode is most 
commonly used when operating the vehicle 100 within the 
5 mission area 140 or during landing of the vehicle 100. For illu- 
strating purposes, figure 1 shows an exemplary route R1' within 
the mission area 140, which the vehicle 100 is controlled to 
follow by means of manual commands representing an alter- 
native set of waypoints denoted WP4'. The vehicle 100 exits the 
10 mission area 140 by resuming the autonomous flight control 
mode at the waypoint WPS. Thereafter, the vehicle continues to 
follow the route R1. 

According to the invention, it is possible to, at any time, control 
the vehicle 100 in the autonomous mode by means of in-flight 

15 programmed waypoints. This is accomplished by transmitting a 
set of waypoints to the vehicle 100 via the wireless command 
link 115. The vehicle 100 may then follow the alternative route 
defined by these waypoints, either directly or when it reaches a 
particular position, which represents the start of the alternative 

20 route. Commonly, such in-flight programming is performed when 
the vehicle 100 is located within the mission area 140, such that 
the vehicle 100 for example follows the route R1'. 

Naturally, instead of entering the mission area 140 in the 
manual mode or the above-described in-flight programmed auto- 

25 nomous mode, the vehicle 100 could have continued to fly from 
the waypoint WP4 directly to the waypoint WP5, then continued 
to the waypoint WP6, and so on, according to the pre- 
programmed route R1 in the autonomous mode. In any case, the 
manually controlled flight path R1" from the waypoint WP4 to the 

30 waypoint WP5 via WP4', the in-flight programmed autonomous 
route R1' from the waypoint WP4 to the waypoint WP5 via WP4', 
and the automatically controlled direct route R1 from the 
waypoint WP4 directly to the waypoint WP5 are regarded as parts 
of the primary route R1/R1'. 
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Irrespective of in which flight control mode the vehicle 100 
operates, an on-board functional monitoring system monitors a 
set of flight control parameters which are considered to be 
especially vital. Thus, in case one of these parameters falls out 
5 of an acceptable range, a major alarm condition is activated. 
This in turn, causes the vehicle 100 to, instead of flying along 
the primary route R1 or R1', fly according to an emergency route 
(after a short delay). The emergency route is defined by a 
second set of predefined waypoints which includes one or more 
10 of the following: HP1, HP2, HPS, HP4, HPS, HP6, HP7, TP1, 
TP2, TPS, TP4, TPS, TP6, TP7, TPS, TP9 and IP. Principally, an 
emergency route R2' is entered in order to minimize the risk of 
accidents on the ground, wherein personnel may be injured 
and/or uncontrolled material damages may be caused. There- 
15 fore, all emergency routes must be planned such that they do 
not pass over or near to a restricted area 1S1-1SS. Each 
restricted area 151-1SS is defined as a geographical sector 
which, for some reason, should not be flown over by a UAV. For 
example, the restricted areas 151-153 may include highly popu- 
20 lated districts, otherwise densely built-up regions and/or terrain 
segments over which it is particularly difficult to fly and navi- 
gate. 

A first sub-group of waypoints within the second set of pre- 
defined waypoints (so-called return waypoints) HP1-HP7 are 
used to define one or more emergency routes. These waypoints 
thus indicate a return path for the vehicle 100 in case it should 
suffer from a fault, which may jeopardize the vehicle's 100 man- 
euverability. However, the severity of the fault is here normally 
not worse than a crash landing is still deemed to be avoidable 
(although naturally this cannot be excluded as an ultimate out- 
come of the fault). A short interruption of the command link 115 
constitutes one example of a fault in this category. An exem- 
plary emergency route R2' is illustrated in the figure 1 by means 
of a dotted line from the route R1, via the return waypoints HP4 
and HPS, to the approach point IP. 
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Should however, a more serious flight control problem arise; the 
vehicle's 100 flight is diverted towards another type of waypoint, 
a so-called termination waypoint TP1-TP9. These waypoints rep- 
resent a second sub-group of waypoints within the second set. 
5 The emergency route must be planned such that at any 
geographical position and altitude thereon a suitable termination 
waypoint TP1-TP9 may be reached in the event of an engine 
failure. Moreover, all emergency routes are allocated at least 
one termination waypoint TP1-TP9. Each termination waypoint 

10 TP1-TP9 defines a geographical position where it is estimated 
that the vehicle's 100 flight may be ended without injuring any 
personnel or causing uncontrolled material damages. Conse- 
quently, all the termination waypoints TP1-TP9 are located 
outside, and at a particular minimum distance from the restricted 

15 areas 151-153. Moreover, each termination waypoint TP1-TP9 is 
selected so that it can be reached from the emergency route, for 
example R2', when flying from one return waypoint to its sub- 
sequent neighbor at a typical altitude and speed. What 
represents a typical altitude and speed varies considerably 

20 depending on the type of vehicle and for which function it is 
designed. Normally, no termination waypoints are defined in the 
mission area 140. Hence, if a serious flight control problem 
occurs when the vehicle 100 is located within the mission area 
140, the vehicle 100 is allowed to become uncontrollable and 

25 crash arbitrarily. However, if a less critical fault appears, the 
vehicle 100 will be controlled to fly towards a waypoint (e.g. 
HP4) located near the boundary of the mission area 140. This 
will be discussed in further detail below. 

The engine thrust constitutes one important example of a flight 
30 control parameter with such potentially detrimental effects that 
the vehicle 100 should be controlled towards one of the termi- 
nation waypoints TP1-TP9, at least if the vehicle 100 is only 
equipped with a single engine. Therefore, according to the 
invention, if an engine parameter (e.g. related to the thrust 
35 force) decreases below a threshold value (or even causes the 
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engine to stall), an alarm condition with respect to an engine 
failure is activated. Temperature level, pressure level and 
revolutions per minute (rpm) are other engine parameters which 
may trigger such an alarm condition. 

5 A locked/malfunctioning servo-unit represents yet another 
example of an error type which may cause flight control 
problems of similar magnitude. Hence, preferably, the functional 
monitoring system also monitors relevant servo-unit parameters. 

In case of an engine failure and after that the vehicle 100 has 
10 reached an air space above a termination waypoint TP1-TP9, 
the vehicle 100 will circle in the air while gradually lowering its 
altitude until it completes an emergency landing at the 
termination waypoint TP1-TP9, If, during execution of these 
circling maneuvers, the problem which forced the vehicle 100 to 
15 fly (or glide fly) to the termination waypoint TP1-TP9 is resolved, 
the vehicle 100 transmits a status message to the control station 
110 indicating this fact. Thereby, via an acknowledgement 
message and overriding commands from the control station 110, 
the termination process may be cancelled. 

20 If the vehicle 100 is controlled to a termination waypoint TP1- 
TP9 because the command link has been broken during an 
extended time, the vehicle 100 will first circle in the air above 
the termination waypoint TP1-TP9 until a particular timer has 
elapsed. Then, the vehicle 100 initiates an emergency landing at 

25 the termination waypoint TP1-TP9. This will be described in 
further detail below with reference to the figures 2, 4 and 5. 

In addition to the return waypoints HP1-HP7 and the termination 
waypoints TP1-TP9, the emergency route includes the approach 
point IP, over which the vehicle will circle in the air while awai- 
30 ting a landing order from the control station before initiating a 
landing at the base location 130. Preferably, the approach point 
IP is also included in the primary route R1 because also on this 
route, a user prompted landing is generally desirable. Table 1 
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below describes the primary route R1, alternative emergency 
routes R2, R2' (indicated with bold arrows) and their respective 
waypoints, return waypoints and termination waypoints. 
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Table 1 



The table 1 represents a high-level program sequence, which for 
each waypoint towards which the vehicle 100 is directed to fly 
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specifies a return waypoint and a termination waypoint being 
applicable in case a major alarm condition occurs. For example, 
the first line, wherein in the second column has index = 1, indi- 
cates conditions being applicable when the vehicle 100 flies 
5 towards a first waypoint WP1. Correspondingly, the second line, 
wherein in the second column has index = 2, indicates con- 
ditions being applicable when the vehicle 100 flies towards a 
second waypoint WP2, and so on. 

The program is then executed stepwise - one index after the 
10 other - such that after having passed a particular waypoint (say 
WP1) as specified in the third column, the procedure steps down 
one line (i.e. increments the index by one) and starts flying 
towards the subsequent waypoint (WP2). In this context, a 
waypoint is considered as having been passed if the vehicle 100 
15 first approaches the waypoint, such that it becomes located 
within a particular distance from the waypoint, and then starts to 
move away from the waypoint. Naturally, in practice, each of the 
waypoints in the table 1 above is also associated with a set of 
geographical and physical data, for example indicating a lati- 
20 tude, a longitude, an altitude, a velocity and a maximal roll angle 
for the vehicle 100. 

If a major alarm condition arises before the vehicle 100 has 
reached the waypoint towards which it is currently flying, the 
procedure checks the relevant column (4 or 5 in the table 1) of 
25 the active waypoint index for an applicable subsequent index, 
and jumps to this index. Then, the procedure continues from this 
waypoint index, and so on. The procedure stops whenever an 
approach point IP or a termination waypoint TP has been 
reached. 

30 Hence, the table 1 specifies the primary route R1/R1' when the 
vehicle 100 flies in the autonomous mode. The table 1 also 
specifies different emergency routes R2 to be applied in case of 
an alarm condition. However, the table 1 is applicable in the 
manual mode too. Namely in this case, the vehicle 100 repea- 
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tedly searches for a closest waypoint WP1-WP8 or IP, such that 
in case of an alarm condition, it may select an appropriate return 
waypoint HP1-HP7 or a termination waypoint TP1-TP9. More- 
over, a mode switch from the manual mode to the autonomous 
5 mode may be performed at any time. When entering the autono- 
mous mode this way, the vehicle 100 simply starts to fly towards 
the closest waypoint as indicated by the currently active way- 
point index. 

Below follows an example which further will elucidate the pro- 

10 posed method. If the command link 115 is interrupted during a 
sufficiently long interval after that the vehicle 100 has passed 
the waypoint WP3, however not yet has reached the waypoint 
WP4, the vehicle 100 diverts from the primary route R1. Instead, 
the vehicle 100 follows an emergency route R2' towards the 

15 return waypoint HP4. Provided that the command link failure 
remains also after having passed the return waypoint HP4, the 
vehicle 100 continues towards the waypoint HPS with a final 
destination at the approach point IP (see the indices 10, 11 and 
12 in the table 1). Here, however, an engine failure occurs be- 

20 fore the vehicle 100 has reached the return waypoint HPS. 
Therefore, the vehicle's 100 route is again altered. This time, 
the termination waypoint TP9 is its next destination, as opposed 
to the previously intended return waypoint HPS (see index 11 in 
table 1). In this example, we assume that the engine failure 

25 cannot be resolved in due time. Hence, the vehicle 100 emer- 
gency lands (as safely as possible) at the termination waypoint 
TP9. Further details pertaining to the conditions for making the 
decisions to alter the vehicle's 100 path from the primary route 
RI/RV to the emergency route R2', and while on the emergency 

SO route R2', changing the return waypoint HPS to the alternative 
destination TP9 will be described below, with reference to the 
figures 2, 4 and 5. 

Figure 2 shows a time line illustrating the time periods which 
determine the decisions made when altering the vehicle's 100 
S5 routes and destinations according to embodiments of the 
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invention. 

As already mentioned, the vehicle monitors a number of flight 
control parameters, among them a command link parameter 
which reflects a quality of the command link between the control 
5 station and the vehicle. A very simple measure in this regard is 
to define the quality in two discrete levels representing a con- 
nection state and an interruption state respectively. Of course, 
more precise quality levels may also be defined. Here, however, 
it is assumed that the command link is interrupted at a point in 
10 time t = 0. If the command link is interrupted during a first time 
interval T1 (say 1 second) from this point in time t = 0 (i.e. until t 
= ti), an alarm condition with respect to a minor command link 
failure is activated. A horizontal flight of the vehicle is initiated 
in connection with activating this alarm condition. 

15 Normally, a short command link interruption (in the order of 1 
second) can be tolerated without any particular precautionary 
actions being necessary. Should, however, the command link 
remain interrupted during a second time interval T2 (say 5 
seconds), which significantly exceeds the first time interval T1 

20 (i.e. from t = 0 to t = t2; where t2 >> ti), a major alarm condition 
with respect to a command link failure is activated. In this case, 
there is namely a substantial risk that the vehicle becomes 
uncontrollable. Therefore, the vehicle diverts from the primary 
route and starts following an emergency route, which involves 

25 flying the vehicle towards a base location on the ground (such 
as the runway 130 in figure 1). According to a preferred embodi- 
ment of the invention, at this point in time, the vehicle also 
elevates to a predetermined altitude. Both these measures, i.e. 
turning back and elevating, generally improve the radio 

30 conditions and thus increase the chances of reestablishing the 
command link. Moreover, elevating the vehicle generally re- 
duces the risk of a crash landing. 

If the command link returns (i.e. reconnects) before expiry of the 
second time interval, the minor alarm condition with respect to a 
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command link failure is preferably cleared, and the flight control 
of the vehicle is returned to the mode in which the vehicle was 
controlled before the interruption in the command link. 

Nevertheless, if not only the second time interval T2, but also a 
5 third and much longer time interval T3 (say 5 minutes from t = 0) 
expires without the command link returning, the major alarm 
condition remains active and the emergency route is altered, 
such that it involves flying the vehicle to an air space above a 
termination waypoint. The length of the time interval T3 is 
10 generally selected with respect to the accuracy in the navigation 
of the vehicle, such that during the time interval T3 the vehicle 
may not divert unacceptably far from the intended route. In this 
example, it is presumed that the vehicle reaches the air space 
above the relevant termination waypoint (as determined by 
15 preprogrammed information in the vehicle) at a point in time 
t = t4. The vehicle then starts to circle over this termination way- 
point. At expiry of a fourth time interval T4 (say in total 10 
minutes after t = 0) when t = ts, the vehicle initiates an emer- 
gency landing at the termination waypoint. 

According to a preferred embodiment of the invention, the 
vehicle transmits a status message to the control station if the 
command link should return at any instance in time. The vehicle 
is then also enabled to receive overriding commands from the 
control station via the command link. Thereby, the control 
station is informed of the fact that there is a connection to the 
vehicle, and it may be decided that the flight according to the 
emergency route should be discontinued. Instead, the primary 
route may be resumed, for example in the autonomous pre- 
programmed flight control mode. Of course, any overriding com- 
mands from the control station may equally well involve trans- 
mission of the control commands to the vehicle in the form of a 
number of commands constituting an alternative set of predefined 
waypoints, i.e. in-flight programmed flight control. Alternatively, a 
manual flight control may be activated at this point. 
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Figure 3 shows a block diagram over a signal processing system 
300 according to an embodiment of the invention which includes 
a central processing unit 330 and a wireless interface unit 340. 
5 An on-board flight control system 310, a functional monitoring 
system 320 and an interfacing unit 350 are included in the 
central processing unit 330. 

The on-board flight control system 310, in turn, contains an 
autonomous control sub-system 311 and a manual control sub- 

10 system 312. The autonomous control sub-system 311 is adapted 
to control the vehicle to fly according to a primary route defined 
by a first set of predefined waypoints, preferably stored in the 
sub-system 311. Correspondingly, the manual control sub- 
system 312 is adapted to control the vehicle to fly according to a 

15 primary route, however in accordance with real-time commands 
received from the control station 110. These commands arrive 
via the wireless command link 115, the wireless interface unit 
340 and the interfacing unit 350 in the central processing unit 
330. The wireless interface unit 340 is also adapted to send any 

20 status messages generated by the functional monitoring system 
320 to the control station. 

The functional monitoring system 320 is adapted to monitor a 
set of flight control parameters Pl-Pn. In case any of these pa- 
rameters Pl-Pn falls outside an acceptable range, the functional 

25 monitoring system 320 sets a relevant major alarm condition. 
This, in turn, will result in that the vehicle initiates a flight accor- 
ding to an emergency route defined by a second set of stored 
waypoints. Additionally, if a less critical fault is encountered, the 
functional monitoring system 320 may set a minor alarm 

30 condition, which will not cause the vehicle to select the emer- 
gency route. A short interruption of the wireless command link 
constitutes one example of such a fault. 

According to the invention, one of the flight control parameters, 
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say P1, represents a vital engine paranneter. In case this para- 
meter decreases below a threshold value (e.g. implying that the 
rpm is insufficient), the functional monitoring system 320 sets a 
major alarm condition with respect to an engine failure. As a 
5 consequence thereof, the vehicle will take the emergency route 
to an air space above a termination waypoint on the ground at 
which it is estimated that the vehicle's flight may be ended 
without injuring any personnel or causing uncontrolled material 
damages. 

10 Additionally, the wireless interface 340 may generate a signal F, 
which is sent to the functional monitoring system 320. This 
signal F is produced in order to indicate that the command link 
has been reestablished. 

A more detailed description of the operation of the functional 
15 monitoring system 320 and its interaction with the other units in 
the central processing unit 330 will be described below with 
reference to figure 5. First however, the general method of 
controlling a UAV according to the invention will be described 
with reference to figure 4. 

20 It is presumed that the UAV is controllable from a control station 
by means of a wireless command link. Moreover, the UAV may 
be controlled both in an autonomous mode wherein the vehicle 
flies according to a primary route defined by a first set of stored 
waypoints, and in a manual mode wherein the vehicle flies ac- 

25 cording to a primary route defined by flight control commands 
received via the wireless command link. A set of flight control 
parameters is monitored in both the autonomous and the manual 
mode. In case a major alarm condition occurs in any of the 
modes, the method involves flying the UAV according to an 

30 emergency route defined by a second set of predefined way- 
points. 

A particular procedure is devised to prevent the UAV from crash 
landing at an undesired location. Here, a first step 401 checks 
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whether the vehicle's engine is in order. This may involve 
testing if one or more engine parameters, such as thrust force, 
temperature level, pressure level and rpm, lie within an accep- 
table range. If this is the case, the procedure loops back and 
5 stays in the step 401 . However otherwise, a step 449 activates a 
major alarm condition with respect to an engine failure. Subse- 
quently, a step 451 controls the UAV to fly (or glide fly) to an air 
space above a termination waypoint, where it is estimated that 
the UAV's flight may be ended without injuring personnel or 
10 causing any intolerable material damages. 

Now, a more detailed procedure according to the preferred em- 
bodiments of the invention will be described with reference to 
figure 5. Steps 501, 549 and 551 are equivalent to the steps 
401, 449 and 451 respectively in figure 4. However, according to 
15 this embodiment of the invention, if the check in the step 501 
finds that the engine is in order, a following step 503 checks 
whether the command link also has an acceptable quality, and if 
so, the procedure loops back to the step 501. Otherwise, a step 
505 follows. 

20 The step 505 activates a link alarm, which at this stage is 
regarded as a minor alarm condition. Subsequently, a step 507 
checks whether the first time interval has expired (see figure 2), 
and if not, the procedure loops back to the step 501. If, how- 
ever, the first interval has expired, a step 509 follows. This step 

25 again checks whether the engine is in order, and if so, a step 
511 follows. Otherwise, the procedure jumps to a step 549 in 
which an engine alarm is activated to represent a major alarm 
condition. 

The step 511 checks whether the command link still has an 
30 acceptable quality, and if so, a step 513 follows in which the 
minor link alarm activated in the step 505 is cleared. After that, 
a step 515 transmits a status message to the control station 
(see 110 in figure 1). According to a preferred embodiment of 
the invention, an acknowledgement message from the control 
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station in response to the status message is required before the 
flight control of the UAV may be returned to the control mode in 
which it was operated before the link alarm was activated. 

If the test in the step 51 1 is answered in the negative, the proce- 
5 dure continues to a step 516 which checks whether the second 
interval (see figure 2) has expired. If it is found that this interval 
is still running, the procedure loops back to the step 509. Other- 
wise, the link alarm is now regarded as a major alarm condition, 
and a step 517 follows, which orders the UAV to fly towards the 
10 base location (see e.g. 130 in figure 1). Then, a step 519 checks 
whether the engine operates as desired, and if so, a step 521 
follows. Otherwise, the procedure jumps to the step 549. 

The step 521 checks whether the command link has regained an 
acceptable quality, and if so, a step 523 follows in which the 

15 major link alarm is cleared. Additionally, the step 523 involves 
transmission of a status message to the control station. The 
control of the UAV may there after be resumed in the mode in 
which it was controlled before the link alarm was activated. 
However, also in this case, it is preferable that an acknowledge- 

20 ment message is received from the control station first. 

Nevertheless, if the test in the step 521 produces a negative 
result, a step 525 follows, which checks whether the third 
interval (see figure 2) has expired. If this is the case, a step 531 
follows. Otherwise, the procedure continues to a step 527, which 

25 checks whether the UAV has reached the base station, and if so 
the step 515 follows. If, however, the UAV has not yet reached 
the base station, the procedure loops back to the step 517 
wherein it continues to fly towards the base station. The step 
515 here transmits a status message indicating that the UAV 

30 has returned to the base station and may be landed. Either a 
landing maneuver is then automatically initiated (e.g. after 
reception of an acknowledgement message from the control 
station), or the UAV is landed manually by means of real-time 
flight control commands from the control station. 
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If the test in the step 525 finds that also the third interval has 
expired, a step 531 follows wherein the command link is 
checked once more. If the command link here is found to have 
an acceptable quality, a step 533 follows in which the major link 
5 alarm is cleared. The step 533 also involves transmission of a 
status message to the control station, where after the control of 
the UAV may be resumed in the mode in which the UAV was 
controlled before the link alarm was activated. Again, it is 
preferable that an acknowledgement message is received from 
10 the control station first. 

If, it in the step 531 is found that the command link still has an 
unacceptably low quality, a step 535 follows which orders the 
UAV to fly towards a specified termination waypoint (see e.g. 
the table 1). Then, a step 537 checks whether the engine is in 

15 order, and if so, a step 539 follows. Otherwise, the procedure 
jumps to the step 549 in which an engine alarm is activated. The 
step 539 checks whether the fourth interval has expired (see 
figure 2), and if so, a step 541 follows. Otherwise, the procedure 
loops back to the step 535, such that the UAV continues to fly 

20 towards the termination waypoint. If, the UAV has already 
reached this point (i.e. before the fourth interval expires) the 
loop described by the steps 535, 537 and 539 implies that the 
UAV circles over the termination waypoint until the fourth inter- 
val expires. 

25 The step 541 checks whether the command link has an 
acceptable quality, and if so, the step 533 follows wherein the 
major link alarm is cleared and a status message is transmitted 
to the control station, where after the control of the UAV may be 
resumed in the mode in which the UAV was controlled before 

30 the link alarm was activated. Again, it is preferable that an 
acknowledgement message is received from the control station 
first. If the step 541 finds that the command link still has an un- 
acceptably low quality, the procedure continues to a step 543 in 
which a termination of the flight is initiated at the termination 

35 waypoint (which the UAV now shall have reached). Subse- 
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• quently, a step 545 checks whether the termination has been 

completed, i.e. if the UAV's flight is stopped permanently. If so, 
the procedure ends in a step 547 which indicates that a 
successful termination has been accomplished. Otherwise, the 
5 procedure loops back to the step 541, and whatever measures 
which remain to complete the termination are performed. For 
example, this may mean that the circulation maneuvers over the 
termination point are continued with a gradually lowered alti- 
tude. 

10 The step 549, which indicates an engine alarm, may be entered 
from any of the steps 501, 509, 519 or 537 if it is found that the 
engine is malfunctioning. In any case, after the step 549 follows 
a step 551 in which the UAV is ordered to fly, or if the engine 
has stalled, glide fly towards a specified termination waypoint 

15 (see e.g. the table 1). Subsequently, a step 553 checks whether 
the engine is operating satisfactory. The engine problem may 
namely have been resolved since the engine alarm was acti- 
vated, and if so, the engine alarm is cleared in a step 555 and a 
corresponding status message is transmitted to the control 

20 station, such that the termination procedure may be interrupted 
by means of a manual intervention. If, however, the step 553 
finds that the engine is still out of order, the procedure 
continues to a step 557, which checks whether the UAV has 
reached the specified termination waypoint. If this is not the 

25 case, the procedure loops back to the step 551. Otherwise, 
however, a step 559 following the step 557 initiates a termi- 
nation process at the termination waypoint. After that, the pro- 
cedure ends in the step 547, which indicates that a successful 
termination has been accomplished. 

30 Thus, the step 547 represents a definitive end of the procedure. 
Although the procedure according to the flow chart also ends in 
each of the steps 515, 523, 533 and 555, these steps instead 
imply returning the procedure to the start step, preferably after 
reception of an acknowledgement message from the control 

35 station. 
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All of the process steps, as well as any sub-sequence of steps, 
described with reference to the figures 4 and 5 above may be 
controlled by means of a programmed computer apparatus, 
preferably located in an on-board central processor of an 
5 unmanned aerial vehicle's signal processing system. Moreover, 
although the embodiments of the invention described above with 
reference to the drawings comprise computer apparatus and 
processes performed in computer apparatus, the invention thus 
also extends to computer programs, particularly computer 

10 programs on or in a carrier, adapted for putting the invention 
into practice. The program may be in the form of source code, 
object code, a code intermediate source and object code such 
as in partially compiled form, or in any other form suitable for 
use in the implementation of the process according to the 

15 invention. The carrier may be any entity or device capable of 
carrying the program. For example, the carrier may comprise a 
storage medium, such as a ROM (Read Only Memory), for 
example a CD (Compact Disc) or a semiconductor ROM, or a 
magnetic recording medium, for example a floppy disc or hard 

20 disc. Further, the carrier may be a transmissible carrier such as 
an electrical or optical signal which may be conveyed via 
electrical or optical cable or by radio or by other means. When 
the program is embodied in a signal which may be conveyed 
directly by a cable or other device or means, the carrier may be 

25 constituted by such cable or device or means. Alternatively, the 
carrier may be an integrated circuit in which the program is 
embedded, the integrated circuit being adapted for performing, 
or for use in the performance of, the relevant processes. 

The term "comprises/comprising" when used in this specification is 
30 taken to specify the presence of stated features, integers, steps or 
components. However, the term does not preclude the presence or 
addition of one or more additional features, integers, steps or 
components or groups thereof. 
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The invention is not restricted to the described embodiments in the 
figures, but may be varied freely within the scope of the claims. 



